.\" NFSv4 Access Control Lists manual pages
.\" format with: groff -man -Tascii foo.1
.\" richterd
.\".fam T
.\"
.TH NFS4XDR_SETFACL 1 "version 0.3.3, August 2008" "Linux" "NFSv4 Access Control Lists"
.SH NAME
nfs4xdr_setfacl, nfs4xdr_editfacl \- manipulate NFSv4 file/directory access control lists
.SH SYNOPSIS
.ns
.BR nfs4xdr_setfacl  " [OPTIONS] COMMAND "
.IR file ...
.br
.BR nfs4xdr_editfacl  " [OPTIONS] "
.IR file ...
.SH DESCRIPTION
.B nfs4xdr_setfacl
manipulates the NFSv4 Access Control List (ACL) of one or more 
.I files 
(or directories), provided they are on a mounted NFSv4 filesystem
which supports ACLs. 

.B nfs4xdr_editfacl
is equivalent to 
.BR "nfs4xdr_setfacl -e" .
.\".B nfs4_setfacl -e

Refer to the
.BR nfs4xdr_acl (5)
manpage for information about NFSv4 ACL terminology and syntax.
.SS COMMANDS
.TP
.BR "-a " "\fIacl_spec\fP [\fIindex\fP]"
.RI "add the ACEs from " acl_spec " to " file "'s ACL."
ACEs are inserted starting at the
.IR index th
position (DEFAULT: 1) of
.IR file "'s ACL."
.\".ns
.TP
.BR "-A " "\fIacl_file\fP [\fIindex\fP]"
.RI "add the ACEs from the acl_spec in " acl_file " to " file "'s ACL."
ACEs are inserted starting at the
.IR index th
position (DEFAULT: 1) of
.IR file "'s ACL."
.TP
.BI "-x " "acl_spec \fR|\fP index"
delete ACEs matched from
.I acl_spec
- or delete the 
.IR index th
ACE - from 
.IR file 's
ACL.  Note that the ordering of the ACEs in
.I acl_spec
does not matter.
.TP
.BI "-X " acl_file
delete ACEs matched from the acl_spec in
.IR acl_file " from " file "'s ACL."
Note that the ordering of the ACEs in the acl_spec does not matter.
.TP
.BI "-s " acl_spec
.RI "set " file "'s ACL to " acl_spec .
.TP
.BI "-S " acl_file
.RI "set " file "'s ACL to the acl_spec in " acl_file .
.TP
.BR "-b", " --strip"
.RI "strip " file "'s ACL (convert to one synthesized from POSIX mode)."
.TP
.BR "-e" , " --edit"
.RI "edit " file "'s ACL in the editor defined in the EDITOR environment variable (DEFAULT: "
.BR vi "(1)) and set the resulting ACL upon a clean exit, assuming changes made in the editor
were saved.  Note that if multiple
.IR files " are specified, the editor will be serially invoked once per " file .
.TP
.BI "-m " "from_ace to_ace"
.RI "modify " file "'s ACL in-place by replacing " from_ace " with " to_ace .
.TP
.BR "-?" ", " "-h" ", " "--help"
display help text and exit.
.TP
.B "--version"
display this program's version and exit.
.P
.RI "NOTE: if '-' is given as the " acl_file 
.ns
.RB "with the " -A / -X / -S " flags, the acl_spec will be read from stdin."
.SS OPTIONS
.TP
.BR "-R" , " --recursive"
recursively apply to a directory's files and subdirectories.  Similar to 
.BR setfacl (1),
the default behavior is to follow symlinks given on the command line and to skip symlinks
encountered while recursing through directories.
.TP
.BR "-L" , " --logical"
in conjunction with
.BR -R / --recursive ", a logical walk follows all symbolic links."
.TP
.BR "-P" , " --physical"
in conjunction with
.BR -R / --recursive ", a physical walk skips all symbolic links."
.TP
.BR --test	 
display results of 
.BR COMMAND ,
but do not save changes.

.SH PERMISSIONS ALIASES
With 
.BR nfs4_setfacl ,
one can use simple abbreviations ("aliases") to express permissions sets
.RB ( full_set ),
all possible permissions
.RB ( modify_set ),
all permissions except write_acl (C) and write_owner (o).
.RB ( write_set ),
all write permissions (wpAW).
.RB ( read_set ),
all read permissions (raRc).

Please refer to the
.BR nfs4xdr_acl (5)
manpage for information on specific NFSv4 ACE
.IR permissions .

.nf

         everyone@:r-x-----------:-------:allow
            group@:rwx-----------:-------:allow
        group:root:rwxpDdaARWcCos:fdin---:allow
group:builtin_users:rwxpDdaARWcCos:fd-----:allow
group:builtin_users:r--p------c---:fd-----:allow
            owner@:rwxpD-aARWcCos:-------:allow
.fi
.RE
.IP - 2
add ACE granting `alice' generic "read" and "execute" access (defaults to prepending ACE to ACL):
.br
	$ nfs4_setfacl -a u:alice:rxaRc::allow foo
.IP - 2
add the ACE granting all permissions using alias:
.br
	$ nfs4_setfacl -a u:alice:full_set::allow foo
.IP - 2
edit existing ACL in a text editor and set modified ACL on clean save/exit:
.br
	$ nfs4_setfacl -e foo
.IP - 2
set ACL (overwrites original) to contents of a
.I spec_file
named `newacl.txt':
.br
	$ nfs4_setfacl -S newacl.txt foo
.IP - 2
recursively set the ACLs of all files and subdirectories in the current directory, skipping
all symlinks encountered, to the ACL contained in the
.I spec_file
named `newacl.txt':
.br
	$ nfs4_setfacl -R -P -S newacl.txt *
.IP - 2
delete the first ACE, but only print the resulting ACL (does not save changes):
.br
	$ nfs4_setfacl --test -x 1 foo
.IP - 2
delete the second entry in ACL (count starts with '0'):
.br
	$ nfs4_setfacl -x 1 foo
.IP - 2
modify (in-place) the second ACE above:
.br
	$ nfs4_setfacl -m owner@:x::deny  owner@:xo::deny foo
.IP - 2
set ACLs of `bar' and `frobaz' to ACL of `foo':
.br
	$ nfs4_getfacl foo | nfs4_setfacl -S - bar frobaz
.SH AUTHORS
.B nfs4_setfacl 
was written by people at CITI, the Center for Information Technology Integration
.RI ( http://www.citi.umich.edu ). 
This manpage was written by David Richter.
.SH CONTACT
Please send bug reports, feature requests, and comments to 
.RI < dev@ixsystems.com >.
.SH SEE ALSO
.BR nfs4xdr_getfacl "(1), " nfs4xdr_acl (5),
.IR RFC5661  " (NFS) Version 4 Minor Version 1 Protocol."
